CVE-2017-18587 Headers containing newline characters can split messages in hyper
MediumCVSS 5.3
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| crates.io hyper(crates.io) | >= 0.10.0, < 0.10.2 | 0.10.2 |
| crates.io hyper(crates.io) | < 0.9.18 | 0.9.18 |
| crates.io hyper(crates.io) | >= 0.0.0-0, < 0.9.18 | 0.9.18 |
| hyper | < 0.9.18 | 0.9.18 |
| hyper | >= 0.10.0, < 0.10.2 | 0.10.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- rustsec.org third-party-advisory vendor-advisory
- github.com
- github.com
- github.com product
- crates.io product
- Debian Security Tracker CVE-2017-18587 vendor-advisory